Security update for git-annex (moderate)

This update for git-annex to version 6.20180626 fixes the following issues: - CVE-2018-10857: Prevent file content disclosure by refusing to download content that cannot be verified with a hash, from encrypted special remotes and glacier bsc1098062. - CVE-2018-10859: Prevent local gpg encrypted...

openSUSE Security Update : git-annex (openSUSE-2018-697)

This update for git-annex to version 6.20180626 fixes the following issues : - CVE-2018-10857: Prevent file content disclosure by refusing to download content that cannot be verified with a hash, from encrypted special remotes and glacier bsc1098062. - CVE-2018-10859: Prevent local gpg encrypted...

Fedora 27 : gnupg (2018-69780fc4d7)

New upstream v1.4.23 1589802,1589620,1589624 - Remove patches included in upstream release - Note that this includes the fix for CVE-2018-12020 ---- - doc Remove documentation for future option faked sys - build Don't use dev srandom on OpenBSD - Do not use C99 feature - g10 Fix regexp...

[SECURITY] Fedora 28 Update: pass-1.7.2-1.fc28

Stores, retrieves, generates, and synchronizes passwords securely using gpg and git...

[SECURITY] Fedora 27 Update: pass-1.7.2-1.fc27

Stores, retrieves, generates, and synchronizes passwords securely using gpg and git...

[SECURITY] Fedora 27 Update: libgpg-error-1.31-1.fc27

This is a library that defines common error values for all GnuPG components. Among these are GPG, GPGSM, GPGME, GPG-Agent, libgcrypt, pinentry, SmartCard Daemon and possibly more in the future...

openSUSE Security Update : python-python-gnupg (openSUSE-2018-646)

This update for python-python-gnupg to version 0.4.3 fixes the following issues : The following security vulnerabilities were addressed : - Sanitize diagnostic output of the original file name in verbose mode CVE-2018-12020 boo1096745 The following other changes were made : - Add --no-verbose to...

FreeBSD : password-store -- GPG parsing vulnerabilities (53eb9e1e-7014-11e8-8b1f-3065ec8fd3ec)

Jason A. Donenfeld reports : Markus Brinkmann discovered that the parsing of gpg command line output with regexes isn't anchored to the beginning of the line, which means an attacker can generate a malicious key that simply has the verification string as part of its username. This has a number of...

password-store -- GPG parsing vulnerabilities

Jason A. Donenfeld reports: Markus Brinkmann discovered that the parsing of gpg command line output with regexes isn't anchored to the beginning of the line, which means an attacker can generate a malicious key that simply has the verification string as part of its username. This has a number of...

Information Disclosure

imscp/roundcube is vulnerable to information disclosures. The enigma plugin has insecure permissions, allowing a malicious user who has access to the web server to gain access to the gpg private key...

Veeam repository update fails, GPG key error

Challenge When attempting to update the Veeam Agent for Linux or the veeam-release repository package, an error is encountered: GPG key signature on key http://repository.veeam.com/keys/RPM-GPG-KEY-VeeamSoftwareRepo.asc does not match CA Key for repo: veeam or The following signatures were invali...

GPG Reaper - Obtain/Steal/Restore GPG Private Keys From Gpg-Agent Cache/Memory

Obtain/Steal/Restore GPG Private Keys from gpg-agent cache/memory This POC demonstrates method for obtaining GPG private keys from gpg-agent memory under Windows. Normally this should be possible only within 10 minutes time frame --default-cache-ttl value. Unfortunately housekeeping function whic...

Incorrect user showing up in configuration for GPG key signing

When configuring SourceTree to use GPG key signing for commits, an incorrect user is used for a given key. The user shows up as "0", rather than the user that was used to create the key. !gpgconfig.png|width=488,height=316! For more details see the post in the community forum here:...

CVE-2018-1000071

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...

UBUNTU-CVE-2018-1000071

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...

Design/Logic Flaw

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...

CVE-2018-1000071

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...

DEBIAN-CVE-2018-1000071

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...

Design/Logic Flaw

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

CVE-2018-1000071

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...